CVSROOT: /cvs
Module name: src
Changes by: an...@cvs.openbsd.org 2019/02/01 00:02:31
Modified files:
sys/dev/wscons : wskbd.c
Log message:
In wskbdclose(), use the same logic as in wskbdopen() to determine if
the device was opened in write-only mode. Relying on me_evar being NULL
does not work if the wskbd device was opened first followed by opening a
wsmux device. Closing the wskbd device first at this stage would cause
the wscons_event queue inherited from the wsmux device to be freed. This
in turn could cause a panic if an ioctl(WSMUXIO_INJECTEVENT) command is
issued to the wsmux device.
ok deraadt@ visa@
Reported-by: syzbot+ed88256423ae8d882...@syzkaller.appspotmail.com
